Exetools - Oreans UnVirtualizer ODBG Plug-in (WL/TMD/CV)

Exetools (https://forum.exetools.com/index.php)

- Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)

- - Oreans UnVirtualizer ODBG Plug-in (WL/TMD/CV) (https://forum.exetools.com/showthread.php?t=13391)

Quote:

Originally Posted by 1ST (Post 99200)

why do i get machine signature not found?

means either you arent at vm entry point or vm type isnt supported (can be a few more reasons but these 2 are the principle ones)

Quote:

Originally Posted by giv (Post 96296)

I will give you a hand.

this has got expired

>>http://www11.zippyshare.com/v/35048094/file.html

could anyone reup it please? :)

thx in advance!

@sendersu
Here's a video shared by GIV elsewhere ...

I don't think/know if it's the same you're looking for (the one shared here), however.

Code:

http://www80.zippyshare.com/v/j8BPgDcl/file.html

Hope this helps.

Regards,
Tony

Quote:

Originally Posted by Deathway (Post 89764)

[v1.8]
- FISH BLACK variant avaible
- Fixed deofuscation order (GenV6)
- New deofucation scheme for FISH machine
- New smart code tracer for FISH machines
- Stack sort for FISH commands
- Improved management of memory (faster deofuscation)
- Added movzx reg32, [esp+eax+memoffset] on CISC machines
- Added a message prompt when the opcode buffer is not enough
- Added LEAVE instruction for FISH machines
- Added support for CALLs to VM section in FISH machines
- CHECK_PROTECTION macro disabled, now it must be restored by hand
- Fixed QWORD incorrect names for some opcodes
- Fixed a problem when deofuscating RISC machines

Thanks people for all your reports, the plug-in becomes more powerful every day.

Now it fully supports FISH machines.
CHECK_PROTECTION macro has been disbled, it must be restored by hand, there were many troubles when handling this kind of macro.
CodeVirtualizer machines aren't supported (FISH-TIGER).
Hope you like this new update, happy reversing :)

Deathway.

Someone can re-up to a new location? All links on thread are dead. I am working on EXE with this protection - thx!

Can anyone make a mirror ? ;)